Orkes Conductor — Critical Pre-Auth Remote Code Execution via Insecure GraalVM Script Evaluators (CVE-2026-58138)

Publication date: September 19, 2026
Category: Vulnerability / Web Security

Introduction

A critical unauthenticated remote code execution (RCE) vulnerability impacting the Orkes Conductor workflow orchestration platform is being actively exploited in production environments, according to telemetry alerts from Fortinet and threat intelligence providers. Tracked as CVE-2026-58138, the flaw allows remote, unauthenticated attackers to execute arbitrary operating system commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions. Organizations running vulnerable deployments must update immediately to version 3.30.2 or enforce strict perimeter access controls.

What is CVE-2026-58138? (General Analysis)

Orkes Conductor is an open-source microservices and workflow orchestration engine widely used to automate complex, distributed business pipelines. The vulnerability stems from how the engine processes dynamic expression evaluations and task structures within incoming workflow definitions.

According to official National Vulnerability Database (NVD) records, this vulnerability poses an extreme risk to server infrastructure:

  • Official CVE: CVE-2026-58138
  • CWE Classification: CWE-94 (Improper Control of Generation of Code / Code Injection)
  • Official CVSS Vector (CVSS v4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Official CVSS Score: 9.3 (Critical, CVSS v4.0) / 9.8 (CVSS v3.1)
  • CISA KEV Status: Not currently listed in the catalog, but confirmed as actively exploited in the wild.

The core risk arises because the workflow API endpoint accepts incoming requests without requiring prior authentication when evaluating INLINE, LAMBDA, DO_WHILE, and SWITCH task types. If underlying script evaluators are misconfigured, they fail to restrict access to host system resources.

How Does It Work? (Technical Analysis)

The exploitation mechanism leverages the integration of the GraalVM dynamic language execution engine within the Orkes Conductor architecture.

  • Initial Exploit Vector Entry: An attacker transmits an unauthenticated HTTP POST request directly to the Orkes Conductor workflow API endpoint. The payload consists of a maliciously crafted inline workflow definition embedding arbitrary JavaScript or Python expressions.
  • Sandbox Escape and Command Execution: Vulnerable instances (versions 3.21.21 prior to 3.30.2) initialize GraalVM evaluators with unrestricted configurations such as HostAccess.ALL or allowAllAccess(true). When the engine processes these script expressions via the designated task types, the script environment fails to isolate execution. Attackers exploit Java reflection or direct subprocess invocation mechanisms to break out of the intended sandbox boundaries.
  • Operating System Impact: Once sandbox restrictions are bypassed, arbitrary code executes directly with the security privileges of the underlying Conductor server process, often leading to full host compromise.

“Fortinet reported blocking thousands of daily exploitation attempts, highlighting a sharp increase in automated malicious traffic originating globally and targeting exposed Orkes Conductor servers.”

Affected Systems / Environments

The vulnerability directly impacts workflow server deployments running specific version ranges:

  • Affected Software: Orkes Conductor versions 3.21.21 up to (excluding) 3.30.2.
  • Vulnerable Components: Workflow API endpoints handling workflow definitions containing INLINE, LAMBDA, DO_WHILE, and SWITCH task types coupled with unsecured GraalVM evaluators.
  • Risk Profile: Internet-facing deployments lacking network segmentation or perimeter authentication controls protecting management APIs.
CVECWE CategoryImpactCVSS ScoreVector (Summary)
CVE-2026-58138CWE-94Remote Code Execution (RCE)9.3 (v4.0) / 9.8 (v3.1)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H

Mitigation and Detection

Remediation

  1. Immediate Patching: Upgrade Orkes Conductor instances immediately to version 3.30.2 or later, which resolves the insecure evaluator configuration flaw.
  2. Network Hardening: If immediate patching is unfeasible, enforce strict network access controls (such as VPNs, IP whitelisting, or reverse proxy authentication) to shield external access to workflow API endpoints.
  3. Configuration Audit: Review custom or open-source deployments to guarantee that script evaluators explicitly disable total host access permissions (HostAccess.ALL / allowAllAccess).

Detection

  • Log Analysis: Inspect HTTP access logs for abnormal or high-frequency POST requests targeting workflow submission endpoints, specifically looking for embedded payloads referencing system execution commands, Java reflection utilities, or suspicious script patterns (eval, ProcessBuilder).
  • Process Telemetry: Monitor underlying host systems for anomalous child processes spawned by the main Orkes Conductor execution daemon.

Wrapping Up

The active exploitation of CVE-2026-58138 emphasizes the severe security implications of integrating complex dynamic language engines without robust sandboxing boundaries. The ability for remote threat actors to achieve unauthenticated code execution poses a critical threat to enterprise automation pipelines. Applying the official update to version 3.30.2 and reinforcing perimeter defences remain essential steps to mitigate ongoing exploitation campaigns.

References